[PATCH 1/3] svcrdma: use rc_pageoff for memcpy byte offset

[PATCH 1/3] svcrdma: use rc_pageoff for memcpy byte offset

[Chuck Lever]

From: Joshua Rogers <linux@joshua.hu>

svc_rdma_copy_inline_range added rc_curpage (page index) to the page
base instead of the byte offset rc_pageoff. Use rc_pageoff so copies
land within the current page.

Fixes: 8e122582680c ("svcrdma: Move svc_rdma_read_info::ri_pageno to struct svc_rdma_recv_ctxt")
X-Cc: stable@vger.kernel.org
Signed-off-by: Joshua Rogers <linux@joshua.hu>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
---
 net/sunrpc/xprtrdma/svc_rdma_rw.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/sunrpc/xprtrdma/svc_rdma_rw.c b/net/sunrpc/xprtrdma/svc_rdma_rw.c
index 661b3fe2779f..945fbb374331 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_rw.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_rw.c
@@ -848,7 +848,7 @@ static int svc_rdma_copy_inline_range(struct svc_rqst *rqstp,
 			head->rc_page_count++;
 
 		dst = page_address(rqstp->rq_pages[head->rc_curpage]);
-		memcpy(dst + head->rc_curpage, src + offset, page_len);
+		memcpy((unsigned char *)dst + head->rc_pageoff, src + offset, page_len);
 
 		head->rc_readbytes += page_len;
 		head->rc_pageoff += page_len;
-- 
2.51.0

[PATCH 2/3] svcrdma: return 0 on success from svc_rdma_copy_inline_range

[Chuck Lever]

From: Joshua Rogers <linux@joshua.hu>

The function comment specifies 0 on success and -EINVAL on invalid
parameters. Make the tail return 0 after a successful copy loop.

Fixes: d7cc73972661 ("svcrdma: support multiple Read chunks per RPC")
X-Cc: stable@vger.kernel.org
Signed-off-by: Joshua Rogers <linux@joshua.hu>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
---
 net/sunrpc/xprtrdma/svc_rdma_rw.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/sunrpc/xprtrdma/svc_rdma_rw.c b/net/sunrpc/xprtrdma/svc_rdma_rw.c
index 945fbb374331..e813e5463352 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_rw.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_rw.c
@@ -860,7 +860,7 @@ static int svc_rdma_copy_inline_range(struct svc_rqst *rqstp,
 		offset += page_len;
 	}
 
-	return -EINVAL;
+	return 0;
 }
 
 /**
-- 
2.51.0

[PATCH 3/3] svcrdma: bound check rq_pages index in inline path

[Chuck Lever]

From: Joshua Rogers <linux@joshua.hu>

svc_rdma_copy_inline_range indexed rqstp->rq_pages[rc_curpage] without
verifying rc_curpage stays within the allocated page array. Add guards
before the first use and after advancing to a new page.

Fixes: d7cc73972661 ("svcrdma: support multiple Read chunks per RPC")
X-Cc: stable@vger.kernel.org
Signed-off-by: Joshua Rogers <linux@joshua.hu>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
---
 net/sunrpc/xprtrdma/svc_rdma_rw.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/sunrpc/xprtrdma/svc_rdma_rw.c b/net/sunrpc/xprtrdma/svc_rdma_rw.c
index e813e5463352..310de7a80be5 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_rw.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_rw.c
@@ -841,6 +841,9 @@ static int svc_rdma_copy_inline_range(struct svc_rqst *rqstp,
 	for (page_no = 0; page_no < numpages; page_no++) {
 		unsigned int page_len;
 
+		if (head->rc_curpage >= rqstp->rq_maxpages)
+			return -EINVAL;
+
 		page_len = min_t(unsigned int, remaining,
 				 PAGE_SIZE - head->rc_pageoff);
 
-- 
2.51.0

Re: [PATCH 1/3] svcrdma: use rc_pageoff for memcpy byte offset

[Joshua Rogers]

Apologies: is it possible to slightly change the commit msg to include "Found with ZeroPath"? As this bug was, indeed, found with a tool called ZeroPath. If not, it's OK, thought I'd ask.

Thank you.


On Friday, 7 November 2025 at 23:09, Chuck Lever <cel@kernel.org> wrote:

> 
> 
> From: Joshua Rogers linux@joshua.hu
> 
> 
> svc_rdma_copy_inline_range added rc_curpage (page index) to the page
> base instead of the byte offset rc_pageoff. Use rc_pageoff so copies
> land within the current page.
> 
> Fixes: 8e122582680c ("svcrdma: Move svc_rdma_read_info::ri_pageno to struct svc_rdma_recv_ctxt")
> X-Cc: stable@vger.kernel.org
> Signed-off-by: Joshua Rogers linux@joshua.hu
> 
> Signed-off-by: Chuck Lever chuck.lever@oracle.com
> 
> ---
> net/sunrpc/xprtrdma/svc_rdma_rw.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/net/sunrpc/xprtrdma/svc_rdma_rw.c b/net/sunrpc/xprtrdma/svc_rdma_rw.c
> index 661b3fe2779f..945fbb374331 100644
> --- a/net/sunrpc/xprtrdma/svc_rdma_rw.c
> +++ b/net/sunrpc/xprtrdma/svc_rdma_rw.c
> @@ -848,7 +848,7 @@ static int svc_rdma_copy_inline_range(struct svc_rqst *rqstp,
> head->rc_page_count++;
> 
> 
> dst = page_address(rqstp->rq_pages[head->rc_curpage]);
> 
> - memcpy(dst + head->rc_curpage, src + offset, page_len);
> 
> + memcpy((unsigned char *)dst + head->rc_pageoff, src + offset, page_len);
> 
> 
> head->rc_readbytes += page_len;
> 
> head->rc_pageoff += page_len;
> 
> --
> 2.51.0

Re: [PATCH 1/3] svcrdma: use rc_pageoff for memcpy byte offset

[Chuck Lever]

On 11/7/25 10:23 AM, Joshua Rogers wrote:
> Apologies: is it possible to slightly change the commit msg to include "Found with ZeroPath"? As this bug was, indeed, found with a tool called ZeroPath. If not, it's OK, thought I'd ask.
> 
> Thank you.

Patch description in my tree now reads:

    svcrdma: use rc_pageoff for memcpy byte offset

    svc_rdma_copy_inline_range added rc_curpage (page index) to the page
    base instead of the byte offset rc_pageoff. Use rc_pageoff so copies
    land within the current page.

    Found by ZeroPath (https://zeropath.com)




> On Friday, 7 November 2025 at 23:09, Chuck Lever <cel@kernel.org> wrote:
> 
>>
>>
>> From: Joshua Rogers linux@joshua.hu
>>
>>
>> svc_rdma_copy_inline_range added rc_curpage (page index) to the page
>> base instead of the byte offset rc_pageoff. Use rc_pageoff so copies
>> land within the current page.
>>
>> Fixes: 8e122582680c ("svcrdma: Move svc_rdma_read_info::ri_pageno to struct svc_rdma_recv_ctxt")
>> X-Cc: stable@vger.kernel.org
>> Signed-off-by: Joshua Rogers linux@joshua.hu
>>
>> Signed-off-by: Chuck Lever chuck.lever@oracle.com
>>
>> ---
>> net/sunrpc/xprtrdma/svc_rdma_rw.c | 2 +-
>> 1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/net/sunrpc/xprtrdma/svc_rdma_rw.c b/net/sunrpc/xprtrdma/svc_rdma_rw.c
>> index 661b3fe2779f..945fbb374331 100644
>> --- a/net/sunrpc/xprtrdma/svc_rdma_rw.c
>> +++ b/net/sunrpc/xprtrdma/svc_rdma_rw.c
>> @@ -848,7 +848,7 @@ static int svc_rdma_copy_inline_range(struct svc_rqst *rqstp,
>> head->rc_page_count++;
>>
>>
>> dst = page_address(rqstp->rq_pages[head->rc_curpage]);
>>
>> - memcpy(dst + head->rc_curpage, src + offset, page_len);
>>
>> + memcpy((unsigned char *)dst + head->rc_pageoff, src + offset, page_len);
>>
>>
>> head->rc_readbytes += page_len;
>>
>> head->rc_pageoff += page_len;
>>
>> --
>> 2.51.0
> 


-- 
Chuck Lever

Re: [PATCH 1/3] svcrdma: use rc_pageoff for memcpy byte offset

[Joshua Rogers]

Sounds reasonable, or "Found by Joshua Rogers with ZeroPath(https://zeropath.com)", but I have no problem with either.

thx

On Friday, 7 November 2025 at 23:30, Chuck Lever <cel@kernel.org> wrote:

> 
> 
> On 11/7/25 10:23 AM, Joshua Rogers wrote:
> 
> > Apologies: is it possible to slightly change the commit msg to include "Found with ZeroPath"? As this bug was, indeed, found with a tool called ZeroPath. If not, it's OK, thought I'd ask.
> > 
> > Thank you.
> 
> 
> Patch description in my tree now reads:
> 
> svcrdma: use rc_pageoff for memcpy byte offset
> 
> svc_rdma_copy_inline_range added rc_curpage (page index) to the page
> base instead of the byte offset rc_pageoff. Use rc_pageoff so copies
> land within the current page.
> 
> Found by ZeroPath (https://zeropath.com)
> 
> 
> 
> > On Friday, 7 November 2025 at 23:09, Chuck Lever cel@kernel.org wrote:
> > 
> > > From: Joshua Rogers linux@joshua.hu
> > > 
> > > svc_rdma_copy_inline_range added rc_curpage (page index) to the page
> > > base instead of the byte offset rc_pageoff. Use rc_pageoff so copies
> > > land within the current page.
> > > 
> > > Fixes: 8e122582680c ("svcrdma: Move svc_rdma_read_info::ri_pageno to struct svc_rdma_recv_ctxt")
> > > X-Cc: stable@vger.kernel.org
> > > Signed-off-by: Joshua Rogers linux@joshua.hu
> > > 
> > > Signed-off-by: Chuck Lever chuck.lever@oracle.com
> > > 
> > > ---
> > > net/sunrpc/xprtrdma/svc_rdma_rw.c | 2 +-
> > > 1 file changed, 1 insertion(+), 1 deletion(-)
> > > 
> > > diff --git a/net/sunrpc/xprtrdma/svc_rdma_rw.c b/net/sunrpc/xprtrdma/svc_rdma_rw.c
> > > index 661b3fe2779f..945fbb374331 100644
> > > --- a/net/sunrpc/xprtrdma/svc_rdma_rw.c
> > > +++ b/net/sunrpc/xprtrdma/svc_rdma_rw.c
> > > @@ -848,7 +848,7 @@ static int svc_rdma_copy_inline_range(struct svc_rqst *rqstp,
> > > head->rc_page_count++;
> > > 
> > > dst = page_address(rqstp->rq_pages[head->rc_curpage]);
> > > 
> > > - memcpy(dst + head->rc_curpage, src + offset, page_len);
> > > 
> > > + memcpy((unsigned char *)dst + head->rc_pageoff, src + offset, page_len);
> > > 
> > > head->rc_readbytes += page_len;
> > > 
> > > head->rc_pageoff += page_len;
> > > 
> > > --
> > > 2.51.0
> 
> 
> 
> --
> Chuck Lever